ban disappeared before expiration
Yesterday, I manually added a decision about the IP 190.108.82.105 for 960h. I checked it was correctly displayed in CrowdsecSec decisions. Some minutes ago I got hit by my CEO because the hacker used that IP again today. I checked the traefik bouncer was effective by banning myself for 15min with success.
Why the 960h ban disappeared in less than 24h ? Thank you.
- CrowdSec Console
CrowdSec is an open-source and collaborative security stack leveraging the crowd power. Analyze behaviors, respond to attacks & share signals across the community. Join the community and let's make the Internet safer, together.
13 Replies
Important Information
Thank you for getting in touch with your support request. To expedite a swift resolution, could you kindly provide the following information? Rest assured, we will respond promptly, and we greatly appreciate your patience. While you wait, please check the links below to see if this issue has been previously addressed. If you have managed to resolve it, please use run the command
/resolve or press the green resolve button below.Log Files
If you possess any log files that you believe could be beneficial, please include them at this time. By default, CrowdSec logs to /var/log/, where you will discover a corresponding log file for each component.
Guide Followed (CrowdSec Official)
If you have diligently followed one of our guides and hit a roadblock, please share the guide with us. This will help us assess if any adjustments are necessary to assist you further.
Screenshots
Please forward any screenshots depicting errors you encounter. Your visuals will provide us with a clear view of the issues you are facing.
© Created By WhyAydan for CrowdSec ❤️
So if you check
cscli decisions list --ip 190.108.82.105 you still see it?
please note, that using traefik does stop the request from going downstream to your application. However, it doesnt completely block the connection so scenarios can trigger again / get logged by traefik. So if you see a trigger it doesnt mean it wasnt blocked but they hit your infrastructure.I see it in decisions tab on the website, I don’t see it in cscli on lapi.
and he definitly reach our application since he exploited some leaked passwords (dude seriously, never reuse the same password on different services…)
oh, I see on the site the status is « applying » seems the site can’t reach my lapi. How possible?
what version is your crowdsec?
hum… well. There’s no ingress so CS can « push » to my lapi pod. Is lapi periodically pulling manual decision made on the website UI?
On your version, not unless you specified the console management flag, on version
1.6.11 the latest this flag is no more and the engine automatically enables this if your on an enterprise account
So best if you upgrade when you can to the latest version if possible.Will do soon. Thank you.
So I upgraded to the latest crowdsec helm chart, and now I’m running :
I see the old decision put through the website via the source
console
I’ll watch if the decision dissappear before expiration, before marking this as solved.
Sadly, the issue is still open. I kept lapi console opened overnight to check. I gathered under reason « Thief » a collection of bad ips captured by our business team:
So yesterday around 7pm i got:
Then some minutes ago, same command:
We can see the expiration wasn’t near to be reached for those which disappeared, even for the one inserted through the web console. How is it possible? Thank you.Next time check if the IP is already on the blocklists
Hm also looks like you had two duplicate entries skipped
Can you do a
SELECT * from decisions where value='45.191.80.187' ?
The IP is part of the curated VPN/proxies list, maybe you are subscribed to it ? (pulling a blocklist with an IP you already have a decision for locally should not behaves like this, but maybe there's a bug)
And do you see anything in crowdsec logs around the time the decision disappear ? (If you have a rough idea of when it disappeared)
You should have a message if it was flushed automatically for some reason (or deleted from the console or anything)There’s an entry:
Indeed, I subscribed to
Curated Proxy/VPN list
Trying to get the logs about the flush…
I see tons of time="2025-08-26T20:54:04Z" level=info msg="flushed 14/5015 alerts because the max number of alerts has been reached (5000 max)"look alike message. Maybe that limit of 5k is the problem?The flush will keeps alerts that still have decisions
so the issue is most likely with the fact the IP also belongs to a blocklist
Could you eventually point where in the source code decisions can be flushed when importing blocklist? Maybe I could help to patch that.
The flush is not performed when pulling a blocklist, it's done automatically every minute. The code is here: https://github.com/crowdsecurity/crowdsec/blob/191f6537ef8fc31c44613770e449637d213d2957/pkg/database/flush.go#L228
The blocklist pull is done here: https://github.com/crowdsecurity/crowdsec/blob/191f6537ef8fc31c44613770e449637d213d2957/pkg/apiserver/apic.go#L599
More precisely by
UpdateBlocklists (https://github.com/crowdsecurity/crowdsec/blob/191f6537ef8fc31c44613770e449637d213d2957/pkg/apiserver/apic.go#L1043)
I'll try to do some testing to see what happens exactly, because quickly looking at the code, I don't see what could delete the decision when doing an update